111992 matches found
CVE-2026-33235
creationtimestamp| type| source ---|---|--- 2026-06-24 22:58:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2zbqsyw22g...
CVE-2026-45687
creationtimestamp| type| source ---|---|--- 2026-06-24 22:45:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2ykfp6xu2f...
CVE-2026-49278
creationtimestamp| type| source ---|---|--- 2026-06-24 22:33:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2xvn64o72k...
CVE-2020-14068
creationtimestamp| type| source ---|---|--- 2026-06-24 22:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mp2wgdt2t22m...
CVE-2020-15362
creationtimestamp| type| source ---|---|--- 2026-06-24 21:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mp2uqp3eve24...
CVE-2026-47733
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, the ImageElement component in packages/gazzodown renders user-controlled src values directly into and attributes without protocol sanitization. Unlike the analogous LinkSpan component — which uses...
CVE-2026-4297
creationtimestamp| type| source ---|---|--- 2026-06-24 21:16:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mp2tl5xum72l...
CVE-2026-11998
A flaw in AngularJS' Strict Contextual Escaping SCE logic allows bypassing certain SCE policies for resource URLs and can lead to arbitrary JavaScript execution within the context of the victim's browser session. SCE's purpose is to ensure that only trusted or safe values are used in certain...
CVE-2026-54066 SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read)
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the patch for CVE-2026-41894 "Path Traversal via Double URL Encoding" sanitized the /export/ route but the identical root cause remains in the /assets/path route. In publish mode anonymous read-only HTTP endpoint,...
CVE-2026-54066 SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read)
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the patch for CVE-2026-41894 "Path Traversal via Double URL Encoding" sanitized the /export/ route but the identical root cause remains in the /assets/path route. In publish mode anonymous read-only HTTP endpoint,...
CVE-2026-54066
SiYuan (
CVE-2026-47733
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, the ImageElement component in packages/gazzodown renders user-controlled src values directly into and attributes without protocol sanitization. Unlike the analogous LinkSpan component — which uses...
CVE-2026-11998
CVE-2026-11998 affects AngularJS SCE (Strict Contextual Escaping) resource URLs. The flaw stems from the URL-matching logic using regular expressions, which can yield partial matches and bypass SCE policies, allowing unsafe values as resource URLs and potentially arbitrary JavaScript execution wi...
CVE-2026-11998 AngularJS XSS via SCE resource URL sanitization bypass
A flaw in AngularJS' Strict Contextual Escaping SCE logic allows bypassing certain SCE policies for resource URLs and can lead to arbitrary JavaScript execution within the context of the victim's browser session. SCE's purpose is to ensure that only trusted or safe values are used in certain...
CVE-2026-11998 AngularJS XSS via SCE resource URL sanitization bypass
A flaw in AngularJS' Strict Contextual Escaping SCE logic allows bypassing certain SCE policies for resource URLs and can lead to arbitrary JavaScript execution within the context of the victim's browser session. SCE's purpose is to ensure that only trusted or safe values are used in certain...
CVE-2026-11998 AngularJS XSS via SCE resource URL sanitization bypass
A flaw in AngularJS' Strict Contextual Escaping SCE logic allows bypassing certain SCE policies for resource URLs and can lead to arbitrary JavaScript execution within the context of the victim's browser session. SCE's purpose is to ensure that only trusted or safe values are used in certain...
DRUPAL-CONTRIB-2026-053
This module enables you to use OpenAI as a provider for the AI module. The module doesn't sufficiently sanitize user-supplied URLs, leading to a Server-side request forgery SSRF vulnerability. This vulnerability is mitigated by the fact that an attacker must have the access to change the host url...
CVE-2026-54699
Warp is an agentic development environment. From 0.2024.03.12.08.02.stable01 until 0.2026.05.06.15.42.stable01, Warp contains an OS command injection vulnerability in the WSL URL-opening fallback. When Warp is running under WSL and cannot open a URL through wslview, it falls back to a Windows...
CVE-2026-53112
creationtimestamp| type| source ---|---|--- 2026-06-24 18:07:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2j2h5clr2f 2026-07-06 06:48:51+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260706 2026-08-03 08:25:33+00:00| seen...
CVE-2026-54699
Warp contains an OS command injection in the WSL URL-opening fallback. When Warp runs under WSL and cannot open a URL via wslview, it uses a Windows command processor path, and a URL controlled through terminal output can reach this fallback when opened. Affected versions range from 0.2024.03.12....